search

Yubico / yubikey-personalization

YubiKey Personalization cross-platform library and tool
https://developers.yubico.com/yubikey-personalization/
BSD 2-Clause "Simplified" License
300 stars 82 forks source link

Cheap Salt? #40

Closed StormTide closed 10 years ago

StormTide commented 10 years ago

https://github.com/Yubico/yubikey-personalization/blob/6f669f5a1a1b4b02a10c82bdb96e8c077e01481b/ykpers.c#L352

Salting from time seems like a questionable activity. Is there any known scenario where this is called into?

klali commented 10 years ago

This code is called into when the CLI is running on windows and no aeskey is supplied.

That whole code-path is weird and of questionable usefulness, I'm about to push a line of commits that throws an error in that function instead and stops using it from the CLI. Thanks for bringing our attention to it!

/klas